On Thu, Oct 22, 2015 at 6:56 PM, DerekC <[email protected]> wrote: > I am running OSSEC with monitoring set on /etc with syscheck running every > 30 minutes. > > I will make a change to a file and I receive an alert that the file has > changed the next time syscheck runs. > I then change the fill back to its original state, but I do not receive an > alert that the file has been changed. > > If I make a different change to the file, I receive an alert. It's ONLY when > the file changes back to it's original state that I do not receive an alert. > > Is this a configuration issue that I am missing? > > Please let me know if this makes sense. >
That's an interesting issue. Try creating a new file and letting it be picked up by syscheck. Then modify the file. Let the change be alerted via syscheck. Stop the OSSEC processes on the manager (or that system if it is a local installation). Open the syscheck db file for that system in a text editor (/var/ossec/queue/syscheck), and remove the old entry for that file. Start the OSSEC processes again, revert the file, and see if an alert is created. > Thanks! > > > Below is the ossec.conf file on the agent: > > <!-- OSSEC example config --> > > <ossec_config> > <client> > <server-ip>10.0.1.10</server-ip> > </client> > > <syscheck> > <!-- Frequency that syscheck is executed --> > <frequency>1800</frequency> > <alert_new_files>yes</alert_new_files> > > <!-- Directories to check (perform all possible verifications) --> > <directories report_changes="yes" check_all="yes">/etc</directories> > <directories report_changes="yes" realtime="yes" > check_all="yes">/bin,/sbin,/usr/bin,/usr/sbin,/usr/local/bin,/usr/local/sbin</directories> > > <!-- Files/directories to ignore --> > <ignore>/etc/mtab</ignore> > <ignore>/etc/hosts.deny</ignore> > <ignore>/etc/mail/statistics</ignore> > <ignore>/etc/random-seed</ignore> > <ignore>/etc/adjtime</ignore> > <ignore>/etc/httpd/logs</ignore> > <ignore>/etc/lvm/archive</ignore> > <ignore>/etc/lvm/backup</ignore> > <ignore>/etc/lvm/cache</ignore> > <ignore>/etc/service/</ignore> > </syscheck> > > <rootcheck> > <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files> > > <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans> > </rootcheck> > > <localfile> > <log_format>full_command</log_format> > <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command> > </localfile> > </ossec_config> > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
